Farsight DNSDB Scout is a graphical user interface for the Farsight DNSDB API. Query passive DNS data, investigate threats, and explore DNS history. Learn more in the user guide or get started with the Flexible Search guide. Farsight DNSDB Scout is a graphical user interface (GUI) for the Farsight DNSDB API. Available in all popular web browsers via a website or browser extension, it supports all of the major features of the Farsight DNSDB API including: - A Dashboard for making queries - An API key status tracker - Punycode support for converting Internationalized Domain Names (IDN) - Filters for queries, such as Time Fencing, Record Types, and Bailiwicks - A locally stored history of recent queries for re-loading and re-running later - Exporting of results to CSV, JSON, TXT, and PDF formats - and more This guide introduces you to Scout and its many features. If you're new to passive DNS, Farsight DNSDB Scout's form and function might seem confusing at first, but this guide will help you get started. ## Accessing Farsight DNSDB Scout ### Google Chrome extensions and Mozilla Firefox add-ons If you plan on using Farsight DNSDB Scout as a browser extension in either Google Chrome or Mozilla Firefox then the rest of this guide assumes that it's already installed. If you haven't installed it, please visit the store page for your web browser and install it. - Google Chrome - Select Add to Chrome to install the extension - Mozilla Firefox - Select Add to Firefox to install the extension After the extension has been added to your browser, click the orange Scout icon in the top-right corner to bring up the Scout Popup menu. This is the primary way to open the Scout extension to check on your API key status and to navigate to the Dashboard and Options pages. ### Website version Access Farsight DNSDB Scout by visiting https://scout.dnsdb.info/ in any popular web browser, including on smaller devices like phones and tablets. You might prefer or require this access method depending on your device owner's restrictions, device platform restrictions, or web browser compatibility. Some platforms, such as iOS, do not allow web browser extensions, and other web browsers might not have a Farsight DNSDB Scout extension release available yet. ## Farsight DNSDB API keys To use Farsight DNSDB Scout you must have a Farsight DNSDB API Key. If you're already a Farsight DNSDB customer then your existing API Key works. If you don't have an API Key yet then please contact the DomainTools sales team. ### Setting an API key in Farsight DNSDB Scout Upon loading up Farsight DNSDB Scout for the first time you encounter a message stating that your API Key hasn't been set yet. Farsight DNSDB Scout doesn't ship with a default API Key so you need to set your own. To do this, visit the Options page by clicking the purple 'gear' icon near wherever you saw the warning message. Most users visit the Options page only once to set and save their API keys. Enter yours into the field and click the Save API Key button. { .img-full } When you click the save button, Farsight DNSDB Scout queries the default Farsight DNSDB server for your API Key status to verify its validity. API Key status checks do not count against your Farsight DNSDB query quota and are free of charge. If your API Key is valid, a confirmation message appears and the API Status area at the top of the screen updates to resemble one of the following, depending on how your API Key was provisioned. The status indicates how many Farsight DNSDB queries you have left and time until your API Key expires (if applicable): Farsight DNSDB Community Edition Farsight DNSDB Trial and Standard Editions If your API Key isn't valid, the API status area reverts to the message stating your API Key is expired or hasn't been set yet. In this case, ensure you've copy-pasted the correct API Key and try saving it again. If you continue to have trouble setting your API Key, contact our Technical Support team at . If you use Farsight DNSDB Export, you may also need to point Scout at your Export instance's API Endpoint before queries succeed. See the Farsight DNSDB Scout endpoints tutorial for how to set and troubleshoot the endpoint. You can now make Farsight DNSDB queries on the Dashboard page. Click the Farsight DNSDB Scout logo, the link that appeared when you entered your API Key, or the purple search button to go to the Dashboard: { .img-full } ## Understanding pivots A pivot is a sequential step between two sets of data, linked by some common factor or shared data element. Exploring Farsight DNSDB usually takes the form of following pivots to discover relationships between domains, IP addresses, and DNS infrastructure. Understanding pivots is critical to using Farsight DNSDB to its fullest potential. We've created a comprehensive tutorial guide that walks through the most common Farsight DNSDB pivots: Farsight DNSDB Scout pivot tutorials - Learn the 9 most common investigative techniques including: - Finding IP resolution history for domains - Discovering domains hosted on an IP address - Exploring entire netblocks - Mapping unknown subdomains - Finding domains using shared infrastructure (name servers, mail servers, CNAMEs) - Searching across multiple TLDs - Working with internationalized domain names ## Understanding wildcard domains When a DNS zone is configured with a wildcard record (*.example.com), any query under that domain returns a positive response, even when no actual infrastructure exists at that name. Passive DNS records these resolutions, so Farsight DNSDB can accumulate thousands of entries for a single wildcard zone. Wildcard queries can surface these domains, especially when your search terms are broad. Reduce the noise using exclusions, time fencing, and record type filters. ### How Farsight DNSDB handles wildcard domains Farsight DNSDB filters wildcard domains at ingest, before they enter the database. This reduces visible wildcard noise, but doesn't eliminate it entirely. Wildcard domains that pass the ingest filter are added to Farsight DNSDB and visible in the API. Because filtering runs at first observation, these entries remain visible even when later occurrences are filtered out. Farsight DNSDB doesn't retroactively remove entries that passed the ingest filter. Scout has no per-search filter for wildcard domains, but you can filter results locally after downloading them. ## Feature explanation: recent queries Farsight DNSDB Scout stores your Farsight DNSDB queries locally, via your web browser's cache. This is convenient for re-running and loading previous queries, but this may also be something you'll want to explicitly clear if you're conducting a sensitive investigation on a shared system. Some web browsers automatically prune your Recent Query cache; if not, Farsight DNSDB Scout self-prunes whenever 2GB of queries have been stored or 75 queries have been made (the specific details of the pruning process depend on which web browser you're using). To review queries you've previously made, click the "Recent Queries" tab in the Dashboard. { .img-inline } In the Recent Queries tab is a table that shows all of your previous queries. { .img-full } Each query has a few functions: - The Re-Run button performs the query again, from scratch, to fetch new results. This is useful if a domain is rapidly updating - The View button loads the query from cache and displays it in the Dashboard. This is useful if you want to re-export a query into a CSV or JSON file later on - Clicking the Request of a query expands the query to its raw form, revealing the raw API URL, HTTP Status code, and other information about the query when it was performed. This is useful for documenting or debugging a query that you've run At the top-right of the Recent Queries tab is a button to clear the Recent Queries completely. If your Recent Queries are taking a while to load, you may want to clear them manually. ## Feature explanation: time fencing Time Fencing improves the signal to noise ratio of results by filtering results to specific time ranges that are more relevant to an investigation or event. Control Time Fencing with a set of three query parameters, all of which are optional: - Seen After: Allows for results where they were observed after a given date. This is the most frequently used Time Fencing option in Farsight DNSDB Scout. - Seen Before: Allows for results where they were observed before a given date. - Strict Mode: Only allow for observations that fall strictly on the specified side of a Time Fence. If enabled and both Time Fences are used, the observations are strictly between the Time Fences. This is also known as a 'complete' Time Fence. By itself, the Seen After parameter defines a 'soft' limit for a date range and kicks off a 'Last Seen After' query where observations have a Last Seen date sometime after the date specified. When the Strict Mode is enabled, the Seen After parameter defines a 'hard' limit and kicks off a 'First Seen After' query where observations have a First Seen date sometime after the date specified. These types of queries are exclusive; you can't use both a 'Last Seen After' and 'First Seen After' query at the same time. { .img-full } Similarly, the Seen Before parameter defines a 'soft' limit for a date range and kicks off a 'First Seen Before' query where observations have a First Seen date sometime before the date specified. When the Strict Mode is enabled, the Seen Before parameter defines a 'hard' limit and kicks off a 'Last Seen Before' query where observations have a Last Seen date sometime before the date specified. These types of queries are exclusive; you can't use both a 'First Seen Before' and 'Last Seen Before' query at the same time. { .img-full } Using both Seen After and Seen Before parameters together define a left bound and right bound date range for query results, and the Strict Mode defines their strictness. When looking at a timeline, use Seen After as the left bounding parameter and Seen Before as the right bounding parameter. Results that appear in-between satisfy either the Seen After parameter, the Seen Before parameter, or both simultaneously. { .img-full } { .img-full } In Farsight DNSDB Scout the Time Fencing parameters have their own section. Click the [+] Time Fencing header to expand the section. Once expanded, the fields for entering the Seen After and Seen Before parameters appear. Click the header again to hide the section. { .img-full } { .img-full } Farsight DNSDB and Farsight DNSDB Scout operate using Coordinated Universal Time (UTC); when selecting a Time Fencing date, it is in UTC. Click a Time Fencing field to open a date picker. In order, select the Year, Month, Day, Hour, and Minute for the date you want. Farsight DNSDB Scout also supports Unix timestamp conversion. Typing or pasting in a Unix timestamp automatically converts it to a human-readable date. For example, copy-pasting 1577959872 into a field results in January 2, 2020 10:11 AM. The Clear button in the Time Fencing section only applies to the Time Fencing fields. Use this to quickly clear Time Fencing parameters between queries as needed. For a more in-depth exploration into Farsight DNSDB Time Fencing we recommend: - Farsight Time Fencing: A Post-Attack Time Machine ## Feature explanation: exporting to CSV, JSON, and PDF/Print After running a successful query or loading a query from the Recent Query tab, a table of results appears on the main Dashboard. Just above the results is an Export dropdown. The CSV option exports the current table to a CSV file while the JSON option exports the current table to a JSON file. The JSONL option is a variation of JSON format where each result is on a newline. The TXT option exports the results in a text format resembling dig command output. The PDF/Print option takes you to a new tab to help optimize the table results for paper-like formats. If you have filtered your results using the fields just above the table, the Export Filtered options are enabled. Your browser handles the file exporting process and stores it in your default downloads directory. { .img-inline } Use these export options to transfer your query results to another tool and format. ## Feature explanation: Copy-Cell-to-Clipboard behavior Farsight DNSDB Scout provides a single-click copy feature for individual cells in the Results Table. Click any RRName, Bailiwick, or RData cell to copy its contents to your clipboard. ### Default behavior By default, copied data includes: - Bracket defanging: Domain names and IP addresses are defanged using bracket notation (e.g., example[.]com, 192.168[.]1[.]1) - Root dot removal: The trailing dot is removed from FQDNs where applicable The RRType column copies without extra formatting. ### Rationale This default behavior addresses common workflow issues: - Copying domain names and IP addresses with quotes into tools like Excel and Iris Investigate was cumbersome - Users spent time manually removing quotes, making them counter-productive as a defanging mechanism - Bracket defanging provides a safety mechanism while promoting interoperability with Iris Investigate, which can parse defanged inputs and doesn't expect root dots ### Customizing copy behavior Configure your Copy-Cell-to-Clipboard preferences in the Options page settings. Choose from: - Bracket defanged with root dot removed (default) - Original format with quotes - No extra formatting Note: This setting only affects single-click cell copying. Double-click row copying and exported files use different formatting rules. ## Feature explanation: Exported FQDN behavior Control how FQDNs appear in exported files through the Options page settings. ### Root dot removal option By default, exported RRName, Bailiwick, and RData values match the API response exactly, including trailing root dots. Enable the root dot removal option to automatically remove trailing dots from FQDNs in all exported file types (CSV, JSON, JSONL, TXT). ### Rationale and limitations This option addresses a common workflow issue where users manually removed root dots because other tools don't expect them. Design decisions: - No defanging in exports: Exported files remain faithful to the API response. Defanging would change the meaning of RData in ways inconsistent with the API and how users visually parse FQDNs - Replicability: Exported files should maintain consistency with the API, especially in law-enforcement environments where replicability is critical Limitations: - Deep removal not available: Root dot removal doesn't apply to FQDNs embedded within other data (e.g., SPF/TXT records) to avoid false positives - Reversed RRNames: Root dot removal doesn't apply to reversed RRNames for the same reason - Regex Highlighting impact: If your query specified a root dot with \.$ or equivalent regex, highlighting may fail in PDF exports. The original regex won't match the transformed values (similar to how regex highlighting doesn't work with punycode domains converted to Unicode) ## Feature explanation: Iris Investigate pivot Farsight DNSDB Scout provides direct integration with Iris Investigate for domain analysis. ### Using the Iris Investigate pivot When viewing domain results, hover over any domain to reveal the pivot tooltip. Select Iris Investigate Inspect to open a new browser tab with the Iris Investigate Inspect modal window. This integration allows you to: - View additional information about the domain - Create a new investigation in Iris Investigate - Seamlessly transition from passive DNS research to active investigation The pivot option appears for all domain-based results in the Results Table. ## Feature explanation: CNAME chasing Farsight DNSDB Scout includes a CNAME Chasing feature to resolve CNAME chains to a final A or AAAA record. With CNAME Chasing enabled, Scout repeatedly pivots on the latest available CNAME. This helps answer the question "where does this CNAME record actually point?" as quickly as possible. The CNAME Chasing checkbox is available in Standard Search. The checkbox can be accessed and enabled/disabled when the CNAME RRType is selected: { .img-full } When a CNAME Chasing query is performed, Scout "chases" the latest CNAME chain and provides a summary report for one of three outcomes: - Scout finds an A or AAAA record, successfully ending the chase - Scout can't find a CNAME, A, or AAAA record to follow, indicating an incomplete chase - Scout reaches its chase limit or API quota limit and cuts the chase short. The typical chase limit is 10; Scout Export installations have a limit of 25 In the Recent Queries tab you can review previous queries that were part of a CNAME chase; these queries have the [CNAME Chase] label. { .img-full } ### Examples Using www.nytimes.com, you can see a completed and successful chase that includes five steps: ```text Successful Query for: RRSET prod.nytimes.map.fastlylb.net ANY(Limit5000)[CNAME Chase] Found 35 results CNAME Chase Sequence: www.nytimes.com → www.prd.map.nytimes.com. www.prd.map.nytimes.com → www.prd.map.nytimes.xovr.nyt.net. www.prd.map.nytimes.xovr.nyt.net. → nytimes.map.fastly.net nytimes.map.fastly.net → prod.nytimes.map.fastlylb.net prod.nytimes.map.fastlylb.net → 146.75.53.164 ``` Using abc.com, you can see an incomplete and unsuccessful chase because there aren't any CNAMEs to follow from the initial starting point: ```text Successful Query for: RRSet abc.com CNAME (Limit 5000) [CNAME Chase] The API server processed the query but there are no results to display. CNAME Chase Sequence: abc.com → Chasing incomplete; can't follow CNAME. No CNAME records were found from initial starting point. You may want to try using a different RRType. ``` ## Summary If you have followed this guide to the end, you should now be familiar with all of Farsight DNSDB Scout's major features. For hands-on practice with Farsight DNSDB pivots, see the pivot tutorials. If you have any feedback or would like to see us break down more complicated Farsight DNSDB pivots in the future, contact us with your feedback. For definitions of DNS and Farsight DNSDB terminology, see the glossary. ## References - Joe St Sauver's 8 Common DNSDB "Pivots" for Threat Hunting - Farsight Time Fencing: A Post-Attack Time Machine This guide walks through common Farsight DNSDB "pivots" and investigative exercises using Farsight DNSDB Scout. Understanding pivots is critical to using Farsight DNSDB to its fullest potential. A pivot is a sequential step between two sets of data, linked by some common factor or shared data element. Exploring Farsight DNSDB usually takes the form of following pivots to discover relationships between domains, IP addresses, and DNS infrastructure. ## Prerequisites Before starting these tutorials, ensure you have: - A valid Farsight DNSDB API key configured in Farsight DNSDB Scout - Access to Farsight DNSDB Scout (via website or browser extension) - Basic understanding of DNS concepts (domains, IP addresses, record types) See the Farsight DNSDB Scout user guide for setup instructions. ## Tutorial overview | Tutorial | What you'll learn | Difficulty | |----------|-------------------|------------| | #1: FQDNs to IP addresses | Find IP resolution history for a domain | Beginner | | #2: IP addresses to FQDNs | Discover domains hosted on an IP | Beginner | | #3: IP address ranges | Explore entire netblocks | Intermediate | | #4: Subdomain wildcards | Map unknown subdomains | Intermediate | | #5: Shared name servers | Find domains using same NS | Intermediate | | #6: Shared MX servers | Find domains using same mail server | Intermediate | | #7: Shared CNAMEs | Discover CNAME relationships | Intermediate | | #8: TLD wildcarding | Search across multiple TLDs | Advanced | | #9: Punycode/IDN | Work with international domains | Advanced | ## Pivot #1: FQDNs to IP addresses Finding the IP Address for a Fully Qualified Domain Name (FQDN) is a simple task for a DNS server — it's basically what they were made to do. However, the answer you'll receive from a "regular DNS server" lacks any history and context. ```bash $ dig www.farsightsecurity.com A +short 104.244.13.104 ``` In the example above the dig command can only tell us what a FQDN is resolving to right now and for wherever the DNS server is located. Results from the dig command are both time and location dependent. Farsight DNSDB can provide a history and global observation for the same data, and thus add context to how a FQDN has resolved over time. To do this in Farsight DNSDB Scout for the same FQDN: 1. Go to the Standard Search tab 2. Enter www.farsightsecurity.com into the RRSET Domain field 3. Restrict the RRType field to A records 4. Click the Search button { .img-full } The results that appear give us a timeline of what www.farsightsecurity.com been resolved to using DNS servers worldwide: - Currently resolves to 104.244.14.13 - Previously resolved to 104.244.14.95 from Aug 2020 to Jan 2021 - Previously resolved to 104.244.14.108 from Sep 2018 to Aug 2020 - Previously resolved to 104.244.13.104 from Apr 2015 to Sept 2018 - Previously resolved to 66.160.140.81 from Sept 2013 to Apr 2015 - Previously resolved to 149.20.4.207 from Jul 2013 to Sept 2013 { .img-full } From this simple query we now know how long this subdomain has existed and where it has been before — that's a powerful investigative capability. ## Pivot #2: IP addresses to FQDNs An IP address is a great starting point for an investigation. With normal DNS you can sometimes find what host currently resides at a given IP address by using in-addr and PTR records. ```bash $ dig -x 104.244.13.104 +short archive.farsightsecurity.com. ``` Like in the previous exercise, dig is great for telling us what's happening now from the perspective of a given DNS server. But what if we want more? Farsight DNSDB can provide the history and context for FQDNs sharing a common IP address. To do this in Farsight DNSDB Scout: 1. Go to the Standard Search tab 2. Switch over to RData mode from RRSet mode so we can search the right-hand response/answer part of a DNS record instead of the left-hand query part 3. Select the IP or Network option 4. Enter 104.244.13.104 into the Record Data field 5. Click the Search button { .img-full } In the results that appear we can make a list of all of the FQDNs that have been observed resolving to 104.244.13.104. { .img-full } Using this pivot you may find that hundreds or thousands of domains have shared or are sharing an IP address. Sometimes these may be totally unrelated domains from multiple unrelated owners. Other times you may find that an IP address is commonly used by a single owner for multiple brands, or for hosting a particular theme of traffic — you'll often be able to see this based on the naming schema of the FQDNs you find. Caution: The domains you find with this method may not be harmless or may be purposefully misleading. Take precautions if you decide to probe the results outside of Farsight DNSDB Scout. ## Pivot #3: IP address range to domain names During an investigation it's helpful to check out an entire netblock instead of IP addresses individually. Farsight DNSDB and Farsight DNSDB Scout support CIDR range queries to facilitate this. Additionally, it can be useful to only focus on recent activity — this sort of "time fencing" is also supported. Let's continue using a recent activity example — let's see what domain names have been seen using the 104.244.14.108 to 104.244.14.111 address range in the last week. In Farsight DNSDB Scout: 1. Go to the Standard Search tab 2. Switch to RData mode like in the previous pivot 3. Select the IP or Network option 4. Enter 104.244.14.108/30 into the Record Data field. The CIDR block represents the IP address range above 5. Expand the Time Fencing section and select a date from a week ago for the 'Seen After' option to restrict the query to the last week of observations 6. In this example case, that would be March 24, 2023 12:00 AM UTC 7. Click the Search button { .img-full } In the results that appear we can make a list of the domains that have recently been seen using the given address range over the last week. { .img-full } This pivot is also called the "Know Your Neighborhood" exercise. By exploring a netblock you may find new names you didn't know about previously and get a better feel for what a "neighborhood" of the Internet is like — however, explore with skepticism as any domain name owner can point one of their hostnames "at" any IP address of their choice and generate traffic. Caution: Keep in mind the Count and UTC Dates of the data you find; you may need to interpret your results differently depending on the frequency and time range. A low frequency result from a long time ago may be a "test" server, and spikes over short time ranges could be worth a closer look. UTC Dates can also blend together if you're not reading closely; check both the Time Last Seen and Time First Seen columns before making a conclusion about a FQDN and its activity in regard to your investigation. ## Pivot #4: Subdomain wildcards While investigating a domain you may need to create a map of unknown subdomains and hostnames. Normally this could be challenging, but Farsight DNSDB and Farsight DNSDB Scout significantly simplify this task. To perform a subdomain and hostname search in Farsight DNSDB Scout: 1. Go to the Standard Search tab 2. Enter a domain with a subdomain wildcard in front of it — in this example, use *.farsightsecurity.com in the RRSet Domain field. Wildcards like this can be placed at either end of a FQDN or label, but not both 3. Restricting the Record Types to A, AAAA, or CNAME will help add some clarity — intermingled record types can be hard to parse if you're not familiar with all of their uses. For this exercise, restrict the Record Types to A records 4. Additionally restricting the query to a specific time range will also add clarity. Open the Time Fencing Section 5. Set a 'Seen After' time fence for observations after January 1, 2020 12:00 AM UTC 6. Click the Search Button { .img-full } The results that appear can be sorted for increased readability — click the RRName heading to alphabetize the results. With sorted results we now have a list of subdomains and hostnames observed since the beginning of 2020. Repeat this pivot with a different Record Type (AAAA, CNAME, or ANY) for a different view of the observed traffic. { .img-full } ## Pivot #5: Hosts using a shared name server Another way to discover associated hostnames beyond subdomains and IP addresses is to explore shared name servers. This is a two-step pivot and can lead to a lot of results. This exercise examines the Smithsonian Institution's domains from the starting point of si.edu. ### Step 1: Find a name server 1. Go to the Standard Search tab 2. Enter si.edu into the RRSET Domain field 3. Restrict the Record Type to NS 4. Set the Limit to 1000 (optional) 5. Click the Search Button { .img-full } A recent observation for this example should be a high-count name server record with the data: si-names1.si.edu. and si-names2.si.edu. { .img-full } ### Step 2: Find domains using that name server Hover over the first name server and it'll present you with a pivot tooltip. In the tooltip are a number of pivot options. Clicking second pivot option, which says Standard for RData (name): si-names1.si.edu., performs the next step of this exercise automatically — Farsight DNSDB Scout searches for an RData Name matching si-names1.si.edu. while also using the Record Type and Limit fields we set earlier. The query form at the top of the page changes automatically, and the results are displayed in the table. Click the pivot link to proceed. { .img-full } The results that appear after clicking the pivot link can be sorted for increased readability — click the RRName heading to alphabetize the results. With the sorted results we now have a large list of hosts and domains to paginate through that use si-names1.si.edu. as a shared name server. ### Alternative: Direct search Running this pivot in two steps isn't required. If you already have a name server to start with then you may enter it as a name in an RData query to skip step one. 1. Go to the Standard Search tab 2. Switch to RData mode 3. Enter the name server into the Record Data field 4. Click the Search Button { .img-full } ## Pivot #6: Hosts using a shared MX server Similar to the previous exercise, another way to discover associated hostnames is to explore shared mail servers. This is also a two-step pivot that could yield a lot of results depending on the starting domain. This exercise examines the University of Oregon's mail server and domains, starting from uoregon.edu. ### Step 1: Find a mail server 1. Go to the Standard Search tab 2. Enter uoregon.edu into the RRSET Domain field 3. Restrict the Record Type to MX 4. Set the Limit to 1000 (optional) 5. Click the Search Button { .img-full } In the most recent observation for this example should be a high-count MX record with mxa-000bfd01.gslb.pphosted.com. in the record data. { .img-full } ### Step 2: Find domains using that mail server Hover over the mailserver and it'll present you with a pivot tooltip. In the tooltip are a number of pivot options. Clicking second pivot option, which says Standard for RData (name): mxa-000bfd01.gslb.pphosted.com., performs the next step of this exercise automatically — Farsight DNSDB Scout searches for an RData Name matching mxa-000bfd01.gslb.pphosted.com. while also using the Record Type and Limit fields we set earlier. The query form at the top of the page changes automatically, and the results are displayed in the table. Click the pivot link to proceed. The results that appear can be sorted for increased readability — click the RRName heading to alphabetize the results. With the sorted results we now have a list of hosts and domains that use mxa-000bfd01.gslb.pphosted.com. as a shared mail server. { .img-full } ### Alternative: Direct search Like in the previous exercise, running this pivot in two steps isn't required. If you already have a mail server to start with then you may enter it as a name in an RData query to skip step one. 1. Go to the Standard Search tab 2. Switch to RData mode 3. Enter the mail server into the Record Data field 4. Click the Search button { .img-full } ## Pivot #7: Hosts using a shared CNAME Similar to the previous two exercises, another way to discover associated domains is to explore shared CNAMEs. This is another two-step pivot that could yield a lot of results depending on the starting domain. This exercise starts from the University of Oregon's website, www.uoregon.edu. ### Step 1: Find a CNAME 1. Go to the Standard Search tab 2. Enter www.uoregon.edu into the RRSET Domain field 3. Restrict the Record Type to CNAME 4. Set the Limit to 1000 (optional) 5. Click the Search Button { .img-full } In a recent observation for this example should be a CNAME record with drupal-hosting-web-cluster5-prod.uoregon.edu. in the record data. { .img-full } ### Step 2: Find domains using that CNAME Hover over the CNAME and it'll present you with a pivot tooltip. In the tooltip are a number of pivot options. Clicking second pivot option, which says Standard for RData (name): drupal-hosting-web-cluster5-prod.uoregon.edu., performs the next step of this exercise automatically — Farsight DNSDB Scout searches for an RData Name matching drupal-hosting-web-cluster5-prod.uoregon.edu. while also using the Record Type and Limit fields we set earlier. The query form at the top of the page changes automatically, and the results are displayed in the table. Click the pivot link to proceed. The results that appear can be sorted for increased readability — click the RRName heading to alphabetize the results. With the sorted results we now have a list of hosts and domains that use drupal-hosting-web-cluster5-prod.uoregon.edu. as a shared CNAME. { .img-full } Notably, in this case we see enumerated subdomains and CNAMEs — there may be a www3.uoregon.edu. or a drupal-hosting-web-cluster4-prod.uoregon.edu. that could be worth investigating in subsequent queries. This is one of many patterns to watch for when investigating subdomains and CNAMEs. ### Alternative: Direct search Like in the previous two exercises, running this pivot in two steps isn't required. If you already have a CNAME to start with then you may enter it as a name in an RData query to skip step one. 1. Go to the Standard Search tab 2. Switch to RData mode 3. Enter the CNAME into the Record Data field 4. Click the Search Button { .img-full } ## Pivot #8: TLD and suffix wildcarding Farsight DNSDB supports wildcards before or after a given search parameter — this is particularly useful when searching for similar names across multiple TLDs and suffixes. For example, www.paypal.com is a well-known website — but has www.paypal recently appeared on any other TLDs and suffixes besides .com? Let's find out. In Farsight DNSDB Scout: 1. Go to the Standard Search tab 2. Enter www.paypal.* into the RRSet Domain field to set up a right-hand wildcard query 3. Open the Time Fencing section 4. Set a 'Seen After' Time Fence for the last couple of days. In this example case March 17, 2023 12:00 AM UTC is used 5. Click the Search Button { .img-full } Note: Right-hand wildcard queries take longer than other queries because of the large amount of data Farsight DNSDB is searching. Results for right-hand wildcard queries may take some time to appear. The results for this query can be highly varied depending on RRType, Time Fencing, and current events. Try lowering the Limit to decrease the amount of time these queries take. In the results that appear we can make a list of all the domains, subdomains, and hosts that match our query. Caution: A common use case for this pivot is to search for domains and websites that look similar to a canonical/real one. The domains and hosts you find with this method may not be harmless or may be purposefully misleading. Take precautions if you decide to probe the results outside of Farsight DNSDB Scout. { .img-full } ## Pivot #9: Punycode, unicode, and internationalized domain names Farsight DNSDB Scout Standard Search supports converting Internationalized Domain Names (IDNs) containing Unicode and Unicode suffixes to ASCII by way of Punycode. For example, the domain bbc.在线 is used to host an instance of a BBC news website. The suffix, 在线, is an internationalized domain name suffix meaning "online" in simplified Chinese. The characters 在线 are written in Unicode, but to make it usable in DNS something called "punycode" is used as a conversion layer. With Punycode, this Unicode suffix is converted to xn--3ds443g. In DNS, all IDN conversions begin with xn--. For more information about the What/How/Whys of IDNs and Punycode, we recommend: - Global Internationalized Domain Name Homograph Report The Standard Search Domain tooltip has an indicator of whether or not your web browser has allowed Punycode conversions to work. By default, all major web browsers allows it, but some script blockers may disable it and a warning appears. { .img-inline } As an exercise, try entering an IDN into Scout as part of a basic RRSet Domain query. If you don't know one off the top of your head, try bbc.在线. { .img-full } IDNs, Unicode, homoglyphs, and non-ASCII characters may come up in investigations that would stump other tools. Farsight DNSDB Scout automatically converts these using Punycode for use in Farsight DNSDB queries. Even if you don't intend to go on to make a real query, Farsight DNSDB Scout can be used as a convenient convert-to-punycode tool. ## Next steps Now that you've learned the common Farsight DNSDB pivots, you can: - Explore the Farsight DNSDB Scout user guide for detailed feature explanations - Learn about Flexible Search for advanced query capabilities - Review the Farsight DNSDB API documentation for programmatic access ## References - Joe St Sauver's 8 Common DNSDB "Pivots" for Threat Hunting - Farsight Time Fencing: A Post-Attack Time Machine Farsight DNSDB 2.0 introduces Flexible Search, which adds regular expression and globbing support to Farsight DNSDB queries. Flexible Search allows for more complex searching parameters in Farsight DNSDB queries and enables more granular and accurate search results. Before Farsight DNSDB 2.0, queries couldn't contain metacharacters, groupings, repetitions, and other pattern matching values. Flexible Search enables all of these techniques through the regular expression (regex) and global wildcard expansion (globbing) syntaxes. In this guide you'll see how Flexible Search can be used in Farsight DNSDB Scout to find threats and other interesting things recorded in Farsight DNSDB. ## Accessing Farsight DNSDB Scout Farsight DNSDB Scout is a graphical user interface (GUI) for the Farsight DNSDB API. Available in all popular web browsers via a website or browser extension, it supports all of the major features of the Farsight DNSDB API including the Flexible Search features introduced in Farsight DNSDB 2.0. ### Website version Farsight DNSDB Scout can be accessed by visiting https://scout.dnsdb.info/ in any popular web browser, including on smaller devices like phones and tablets. Accessing Farsight DNSDB Scout this way may be preferred or required depending on your device owner's restrictions, device platform restrictions, or web browser compatibility. Some platforms, such as iOS, don't allow web browser extensions, and other web browsers may not have a Farsight DNSDB Scout extension release available yet. ### Google Chrome extensions and Mozilla Firefox add-ons To use Farsight DNSDB Scout in your browser you need to have the browser extension installed. If you haven't installed Farsight DNSDB Scout, visit the store page for your respective web browser and install it per the instructions. * Google Chrome - Select Add to Chrome to install the extension * Mozilla Firefox - Select Add to Firefox to install the extension After the extension has been added to your browser, click the orange Scout icon in the top-right corner to bring up the Scout "Popup" menu. This is the primary way to open the Scout extension to check on your API key status and to navigate to the Dashboard and Options pages. ## Regular expressions (regex) and the FCRE syntax To enable Farsight DNSDB 2.0's regex searching capabilities, Farsight has adopted a subset syntax of POSIX-Extended Standard regular expressions. This new syntax is called the Farsight Compatible Regular Expression (FCRE) syntax. The FCRE syntax has the following restrictions and simplifications over POSIX-Extended Standard regular expression syntax: 1. Only printable characters are allowed in a search query. 2. Hexadecimal and octal escape sequences are not allowed at all. 3. Only special characters may be escaped with \ (backslash). * Note: ] and } are not considered special characters, but [ and { are. * Note: PCRE extensions and shorthands such as \w and \d are not allowed. 4. POSIX collating elements (e.g., [=ch=], [.a.]) in character classes are not supported. The sequences [= and [. are not allowed in character classes. 5. Capturing groups and backreferences are not supported. In other words, only printable metacharacters may be escaped and collating elements aren't available. Otherwise, your favorite regexes should work when making a regex query in Flexible Search. While using this regex syntax, Flexible Search queries return precise results related to your investigation. Examples of what Flexible Search regex queries look like and how to use them are later in this guide. For a more detailed explanation about the FCRE syntax itself, visit the FCRE Reference Guide. For a detailed guide on how regular expressions apply to domains and DNS, see What's a Regular Expression?. ## Global wildcard expansion (globbing) syntax To enable Farsight DNSDB 2.0's use of global wildcard expansions, Farsight has adopted the standard glob(7) semantics as its "globbing" syntax. This syntax is sometimes referred to as "extended globbing", and also as "globs" as shorthand. Globbing is front and back anchored by default; regular expressions are not anchored by default. As an example, you might try a glob of farsight* to find all matches that begin with "farsight", where the equivalent regular expression would be ^farsight.*$. For a detailed guide on how globbing applies to domains and DNS, see What is Globbing?. While using this globbing syntax, Flexible Search queries support real wildcards on both sides of a domain label or hostname. If a glob query is constructed correctly then it can result in broad keyword-like searches. Examples of what Flexible Search glob queries look like and how to use them are later in this guide. For a more detailed explanation about the globbing syntax itself, refer to the Glob Reference Guide. ### Flexible Search tab Flexible Search is front-and-center in Farsight DNSDB Scout. The Flexible Search tab contains all of the Farsight DNSDB 2.0 searching features. When you open Farsight DNSDB Scout you can start making Flexible Searches right away. { .img-full } ### Syntax Starting from the top of the Flexible Search options, the Syntax option allows you to select between three syntaxes – Keyword, Regex, and Globbing: * Keyword is the pre-selected default – it allows for searching of simple terms like "paypal", "rolex", or "covid". Under the hood, Keyword searches perform a double-ended wildcard globbing query, so think of it as a shorthand for globbing. * Regex is the second option – it allows for the FCRE syntax to be used to craft search queries. With Regex, you can search for things that are "fuzzy" and would not have worked with the original Farsight DNSDB. * Globbing is the third option – it allows for the globbing syntax to be used to craft search queries. With Globbing, real wildcards can be used with literal values instead of the limited wildcards found in the original Farsight DNSDB. For the easiest, but broadest, search results try Keyword. When you start building more complex sequences or want finer control on the results, you'll find that Regex will work better for you. Globbing is a middle ground with finer control than Keyword but is less complex than Regex. ### RRset fields Next is the Left-Hand (RRName) and Right-Hand (RData) Field option. Which one you select will tell the search which field of an RRset to search in. Both support all three of the syntaxes, above. If you're unfamiliar with the Left/Right terminology, the "Left" part of an RRset is the DNS query while the "Right" part is the answer. For example, let's look at an A record RRset: ```text www.farsightsecurity.com IN A 66.160.140.81 ``` www.farsightsecurity.com is the "Left" part of this record, a queryable domain name. 66.160.140.81 is the "Right" part of this record, an answer to the query. These fields are searched separately in Flexible Search. Left-Hand (RRName) search results won't have an RData column/field, and Right-Hand (RData) search results won't have an RRName column/field. To see both fields at the same time and exactly when they were observed, a subsequent Standard Search or a pivot into a Standard Search is required. ### Find The Find field is next; this is the bulk of how you craft your query. The Find field is the primary thing you're searching for in Farsight DNSDB – for example, a keyword like paypal, a regex like p(a|o)ypal, or a glob like payp*. ### Exclude Nearby the Find field is the Exclude field. The Exclude field is a way to restrict observations you know you don't want to see in your search results. A great use case for this is for excluding your own brands, your own corporate website, or a common result that you know will pollute your results. For example, searches involving covid might get polluted by covideo so excluding that may be a good idea. The Exclude field is disabled for Keyword searches. The expression in the exclude field uses the Regex or Glob syntax, depending which Syntax is selected. ### Record type Next is the Record Type dropdown. By default, it uses ANY which means any record type is allowed to appear in your search results. You can restrict which record types appear by changing it in this dropdown. For example, changing it to NS will restrict your search to only return name server results. Note: Unlike in Standard Search, Flexible Search doesn't have any DNSSEC related record types to select from. DNSSEC related observations are not available in Flexible Search. Otherwise, this Record Type dropdown works the same way in Flexible Search as Standard Search. ### Limit Over on the right side of the tab we have the Limit dropdown. Changing the Limit field will restrict how many results your search returns. By default, Farsight DNSDB Scout uses a Limit of 5000. Note: The number of results returned for Flexible Search RRName queries may seemingly exceed the Limit, but the results for these queries use the Limit for the number of unique RRNames seen in the results and doesn't account for multiple RRTypes that may have been observed with the same RRNames. Otherwise, this Limit dropdown works the same way in Flexible Search as in Standard Search. ### Offset To the right of the Limit dropdown is the Offset field. This field lets you specify how many results to "skip" over if you want to go beyond Farsight DNSDB Scout's maximum Limit. The Offset field works the same way in Flexible Search as Standard Search. This effectively raises the maximum Limit. Note: Farsight DNSDB recalculates the results for each query and the order of results might not be preserved. Therefore, this capability is not a valid way to walk all results over multiple queries – some results might be missing and some might be duplicated. ### Time fencing Finally, the Time Fencing area. Time Fencing is used to improve the signal to noise ratio of results by filtering results to specific time ranges that are more relevant to an investigation or event. Time Fencing is controlled by a set of three query parameters, all of which are optional: * Seen After: Allows for results where they were observed after a given date. This is the most frequently used Time Fencing option in Farsight DNSDB Scout. * Seen Before: Allows for results where they were observed before a given date. * Strict Mode: Only allow for observations that fall strictly on the specified side of a Time Fence. If enabled and both Time Fences are used then the observations are strictly between the Time Fences. This is also known as a "complete" Time Fence. For a detailed guide on Farsight DNSDB Time Fencing, see Farsight Time Fencing: A Post-Attack Time Machine. ### Other notes If you're already familiar with Farsight DNSDB Scout or a previous version of the Farsight DNSDB API then you may be looking for a De-Aggregate or Summarize option. These options are not available in Flexible Search. ## Example search \#1: enumerated subdomains An investigation involving a series of enumerated subdomains can be difficult to keep track of with Farsight DNSDB Standard Search. For example, say we find the CNAME drupal-hosting-web-cluster5-prod.uoregon.edu. while looking at observations for www.uoregon.edu. That cluster5 gives us a clue – there are probably more CNAMES like it. With Standard Search we would have to make multiple RRset searches, one for each of these possibilities until we find one that fails: * drupal-hosting-web-cluster1-prod.uoregon.edu. * drupal-hosting-web-cluster2-prod.uoregon.edu. * drupal-hosting-web-cluster3-prod.uoregon.edu. * ... * drupal-hosting-web-clusterN-prod.uoregon.edu. * etc. With a single Flexible Search query in Farsight DNSDB Scout we can figure out how many CNAMES there are that match this pattern instead of guessing at numbers that follow our clue. 1. Open Farsight DNSDB Scout; the Flexible Search tab should already be selected 2. Select the Regex syntax 3. Enter ^drupal-hosting-web-cluster[0-9]+-prod\.uoregon\.edu\.$ into the Find field. This regex means we're looking for some numerical digits after cluster in otherwise the same pattern 4. Click the Search button Depending on your investigation, you may also want to restrict the Record Type, but in this example we'll leave it alone. { .img-full } In the results we find there are six RRNames matching this pattern – now we don't have to guess and check at numbers. { .img-full } If there was a gap in the numbers then we wouldn't have known how large of a gap without this pattern searching. What if there was a cluster8 thru cluster11 even though there's no cluster7? Flexible Search has eliminated the queries we need to "burn" to verify if we found all of the relevant RRNames. This technique is not only useful for CNAMEs, but also RRNames associated with A, AAAA, MX, and NS records. From here, one available option to continue this investigation is to export our results for another tool to use. We can export the results as a different file format using the Export dropdown above the results table. { .img-inline } Another option is to pivot on one of these RRNames into Farsight DNSDB Standard Search. Hover over one of the RRNames, like hosting-web-cluster6-prod.uoregon.edu. and it presents you with a pivot tooltip. In the tooltip are a number of pivot options. Clicking the first pivoting option, which says Standard for RRSet: drupal-hosting-web-cluster6-prod.uoregon.edu., performs a Farsight DNSDB Standard Search for the RRName as part of an RRset query which then allows you to see the full DNS resource record as observed by Farsight DNSDB. { .img-full } { .img-full } Once again, we can export our results as CSV or JSON for another tool to use or we can continue to pivot by clicking the pivot links presented in the table. ## Example search \#2: lookalikes and typosquatting An investigation involving payment and banking systems may involve domain label lookalikes and typosquatting. Let's use some simple regexes to find some domains that look similar to Paypal and Wells Fargo's. First, Paypal. A common phishing technique is to use dashes in a label. Let's see what's out there with a wildcard and some dashes while keeping in mind we want to exclude results for the real Paypal. 1. Open the Flexible Search tab 2. Select the Regex syntax 3. Enter www\..*-paypal- into the Find field. This regex means we're looking for something with www and also paypal between dashes 4. Enter ^.*paypal\.com\.$ into the Exclude field – we know this is the real Paypal so we can exclude it from our results 5. Click the Search button { .img-full } In the results are thousands of RRNames that fit our search. { .img-full } When faced with a lot of results you can narrow them down by re-running the search with a Record Type selection or Time Fencing to keep the results relevant to your investigation. Next, Wells Fargo. A common phishing technique is to duplicate hard-to-distinguish letters, like l. Let's see what's out there by using a repetition regex pattern. 1. Open the Flexible Search tab 2. Select the Regex syntax 3. Enter wel{3,6}sfargo into the Find field. This regex means we're looking for something with three to six l characters that looks similar to wellsfargo 4. Click the Search button { .img-full } Although there aren't as many results in this example as in the previous one, there's still a lot to sort through. You can narrow the results down by re-running the search with the Record Type option and by using Time Fencing, whichever helps you narrow your results so they're relevant to the investigation. { .img-full } ## Example search \#3: brand protection Companies and brands need to defend their intellectual property, even in DNS. Searching for brand names among FQDNs and hostnames to find infringers can be challenging, but Flexible Search and Farsight DNSDB Scout make this easier. Farsight DNSDB Scout offers a customized globbing search option as a syntax: Keyword. By using the Keyword syntax you have an easy way to see what's going on with a brand name that's part of a domain label. Let's use rolex as a Keyword and see what we find. 1. Open the Flexible Search tab 2. Select the Keyword syntax 3. Enter rolex into the Find field 4. Click the Search button { .img-full } In the results you'll see domains that contain rolex somewhere in them; you'll likely find something that doesn't quite represent the brand's true owner very quickly. { .img-full } You can narrow your Keyword Search results by using a Record Type filter for A, CNAME, or NS records and also a Seen After Time Fence for the last month. Doing this will ensure your results contain only recent observations that result from "normal" web traffic patterns. ## Example search \#4: domain generation algorithms (DGAs) Modern botnets and malware sometimes use domain generation algorithms (DGAs) to register and communicate over seemingly random domain names as part of their infrastructure to make them hard to take down. Security experts and researchers have published regular expressions that match these DGAs and these regular expressions are then used to find or block botnets and malware. Using a DGA regular expression, search Farsight DNSDB for observations related to botnets and malware to make a map of when they were spotted and how widespread they were. 1. Open the Flexible Search tab 2. Select the Regex syntax 3. Enter the DGA regular expression into the Find field. In this example we'll use ^f[a-z]{5,6}-[a-z]{4,5}.(ru|com).$ 4. Click the Search button { .img-full } The results contain FQDNs that match this particular DGA. { .img-full } Caution: Not all search results you find using DGA regular expressions are actually part of a botnet or malware; results contain everything that matches the pattern, both malicious and benign. Take precautions if you decide to probe the results outside of Farsight DNSDB Flexible Search and Farsight DNSDB Scout. ## Example search \#5: record misconfiguration Flexible Search can be used as a way to find DNS misconfigurations. For example, a common SPF record mistake is to use an ipv4 or ipv6 modifier instead of the correct ip4 or ip6 modifier. A common SOA record mistake is to use an IP address instead of an MNAME (Primary Name). Let's look for some SPF record mistakes observed in the last month. 1. Open the Flexible Search tab 2. Select the Regex syntax 3. Select the Right-Hand (RData) field option 4. Enter (ipv4|ipv6) into the Find field 5. Select the SPF Record Type 6. Enter a Seen After date for a month ago 7. Enable Strict Mode so observations are First Seen after the Time Fence 8. Click the Search button { .img-full } The results show recent observations that have misconfigured SPF records using an invalid IP modifier of ipv4 or ipv6. { .img-full } Next, let's look for SOA record mistakes observed in the last month. 1. Open the Flexible Search tab 2. Select the Regex syntax 3. Select the Right-Hand (RData) field option 4. Enter 8\.8\.8\.8 into the Find field 5. Select the SOA Record Type 6. Enter a Seen After date for a month ago 7. Enable Strict Mode so observations are First Seen after the Time Fence 8. Click the Search button { .img-full } The results show recent observations that have misconfigured SOA records trying to use Google DNS as an SOA MNAME. { .img-full } ## Example search \#6: COVID-19 related domains COVID-19 has impacted everything, and a way to observe it is through DNS observations. Flexible Search reveals when COVID-19 related domain registrations and websites started reacting to the news. 1. Open the Flexible Search tab 2. Select the Globbing syntax 3. Select the Right-Hand (RData) field option 4. Enter *.covid??* into the Find field. We're looking for domain labels containing covid with at least two characters following it. 5. Select the NS Record Type as they're usually the first-movers with fresh domain registrations 6. Enter a Seen After date for the time period you're investigating 7. Enable Strict Mode so observations are First Seen after the Time Fence 8. Click the Search button { .img-full } In the results we see RData that fits our loose COVID globbing search. { .img-full } A more generic globbing search for *coronavirus* for ANY Record Type yields different results, though this may not be relevant to COVID-19 specifically but rather other strains of coronavirus. { .img-full } { .img-full } To get an idea of the activity periods of these results try pivoting over to Standard Search to see the Time First Seen, Time Last Seen, and Count fields. ## Summary You should now be familiar with how regular expressions (regex) and global wildcard expansions (globbing) work in Farsight DNSDB Flexible Search and within Farsight DNSDB Scout. With Flexible Search you have much more flexibility in crafting searches related to your investigations. If you have any feedback or would like to see us break down more complicated Farsight DNSDB searches in the future please contact us and let us know. Farsight DNSDB Scout is a graphical user interface (GUI) for the Farsight DNSDB API. Available in all popular web browsers via a website or browser extension, it supports all of the major features of the Farsight DNSDB API. You can configure Farsight DNSDB Scout to use a specific Farsight DNSDB API server Endpoint. This guide explores all of the available API Endpoint features. ## Setting an API endpoint By default, Farsight DNSDB Scout uses the primary Farsight DNSDB API host, api.dnsdb.info. Private deployments of Farsight DNSDB Scout for Export may use a different API Endpoint by default, but you can always change it locally within your web browser. To change your API Endpoint, first go to the Options page. Access the Options page via the 'gear' icon in the top right corner. { .img-full } Open the Advanced section of the page. Within the Advanced section is a subsection dedicated to all API Endpoint related settings. { .img-full } The currently set API Endpoint appears pre-filled in the field. Enter a different API Endpoint host and then click the Save Endpoint button to set it. The protocol for an API Endpoint is always https and cannot be changed. If you leave the field empty when clicking the Save Endpoint button, it defaults to api.dnsdb.info or a different preset if you use a Farsight DNSDB Scout for Export instance. { .img-full } When you save the API Endpoint, Farsight DNSDB Scout performs a connection and quota check. If any problems occur when reaching the new API Endpoint, they appear at the top of the screen in the connection and quota display area. { .img-full } If no issues occur when reaching the new API Endpoint, your normal quota information appears and you can start making Farsight DNSDB queries on the main Dashboard. ## Farsight DNSDB export mode You can use Farsight DNSDB Scout with Farsight DNSDB Export instances, and you can even deploy it as Farsight DNSDB Scout for Export with a preconfigured API Endpoint for a specific Farsight DNSDB Export instance. To switch Farsight DNSDB Scout's Export Mode either check or uncheck the Farsight DNSDB Export Instance option within the API Endpoint settings and then click the Save Endpoint button. { .img-full } Note: Some Farsight DNSDB Export instances may only support APIv1, while others may only support APIv2. Additionally, your Farsight DNSDB Export instance may only be accessible while on certain networks. Please check with your Export instance operator regarding API versioning and provisioned access. ### Troubleshooting Export endpoint connection errors If saving the endpoint produces a connection or quota error in the display area at the top of the screen, the API Endpoint is most often pointed at the wrong host. Export hostnames can change between provisioning stages, so an endpoint that worked before may no longer be valid. To resolve it: 1. Confirm the current endpoint hostname with your Export instance operator. 2. On the Options page, open the Advanced section and enter that hostname in the API Endpoint field. Enter the hostname only; the https protocol is assumed. 3. Click Save Endpoint. Scout re-runs the connection and quota check against the new host. If the error persists after confirming the hostname, verify that you're on a network permitted to reach the instance and that you're using the API version your operator supports. ## Setting a different API version Farsight DNSDB Scout supports both of the currently available Farsight DNSDB API versions, v1 and v2. By default, most versions of Farsight DNSDB Scout will use v2. Broadly, v1 lacks Flexible Search and additional improvements made by the SAF Protocol used by v2. Responses from v1 servers differ slightly from those from v2 servers. Some Farsight DNSDB API servers only support v1, so you need to switch Farsight DNSDB Scout to v1 mode to use those servers. If you are using api.dnsdb.info as your API Endpoint then v2 is strongly encouraged over v1. For more details about the differences between APIv1 and APIv2 please refer to the Farsight DNSDB API Documentation. To switch Farsight DNSDB Scout to v1 mode select the APIv1 radio option within the API Endpoint settings and then click the Save Endpoint button. { .img-full } You can switch Farsight DNSDB Scout back to v2 mode by selecting the APIv2 option and re-saving your API Endpoint settings. ## General - Farsight DNSDB: Farsight DNSDB is the Domain Name System Database that stores and indexes passive DNS data. The data in Farsight DNSDB comes from Farsight Security's Security Information Exchange, ICANN's CZDS and ZFA programs, and active enrichment efforts. - GUI: Graphical User Interface or "Point and Click" interface. A set of visual elements (buttons, etc) you can interact with beyond text. - API: Application Programming Interface; a set of established rules and parameters that a client program can use to communicate with a host program. - Pivot: A sequential step between two sets of data, linked by some common factor or shared data element. Exploring Farsight DNSDB usually takes the form of following pivots. ## Files - CSV: Comma Separated Values is a file format making use of commas as a delimiter between data fields. Typically used in spreadsheet tools. - JSON: Javascript Object Notation is a file format used to contain human readable text in key-value pairs and array formats. Commonly used in web browsers and smaller scale databases. Originally created for Javascript, but it is now used in a wide range of tools. - JSONL: Similar to JSON (above) but each Object is separate from the rest and uses its own line. ## Networking - CIDR: Classless Inter-Domain Routing. A succinct way of expressing the size or range of a block of network addresses. - E.g. 1.2.3.0/30 represents 1.2.3.0 thru 1.2.3.3 (four IP addresses) - E.g. 1.2.3.0/25 represents 1.2.3.0 thru 1.2.3.127 (128 IP addresses) - E.g. 1.2.3.0/24 represents 1.2.3.0 thru 1.2.3.255 (256 IP addresses) ## DNS - FQDN: Fully Qualified Domain Name; a domain name that has all of elements required to make it unambiguous when parsing. At minimum, from right to left, one is comprised of a period, top level domain, a period separator, and a name. E.g. example.com. - RRSET: A set of DNS resource records containing or aligned by the same name, class, type, or bailiwick. - Count: The number of times a unique RRSet was observed. - Time Last Seen: The most recent time that an RRSet was observed. - Time First Seen: The first time that an RRSet was observed. - RRName: The queried left hand side of a DNS resource record. - RData: The resulting right hand side of a DNS resource record. - Bailiwick: An enclosing zone for a name server that serves the RRset or the name of the zone containing the RRset. Oversimplified, it's usually the suffix, TLD, or authoritative resource for a record when observed. - TLD: Top Level Domain, the right-most significant part of a FQDN. There are over 1,500 TLDs to date, and more are being added. E.g. .com, .uk, .dev and .在线 are all valid TLDs. - Wildcard: A value that acts as a placeholder for all possible values, represented by a * (star). In DNS, a wildcard can be interpreted as "everything in" something else. E.g. *.example.com represents all of the subdomains in example.com. For the purposes of Farsight DNSDB Queries wildcards are more similar to the Kleene Star in mathematics and regular expressions. E.g. www.example.* represents all occurrences of www.example across all TLDs and suffixes. ## DNS record types - A Record: An IPv4 resource record type used to map a domain name to an IPv4 address. - AAAA Record: An IPv6 resource record type used to map a domain name to an IPv6 address. Commonly pronounced quad-ei. - NS Record: A resource record type used to indicate which DNS server is authoritative for a given domain, a name server. These are often redundantly used to indicate secondary and fallback servers. - MX Record: A resource record type used to direct mail traffic for a domain, for mail exchangers. These often have priorities assigned to them for mail delivery redundantly. - CNAME Record: A resource record type used to alias or canonically relabel a domain or subdomain to another domain. E.g. www.bbc.com is a CNAME that resolves to the same IP address as www-bbc-com.bbc.net.uk. - TXT Record: A resource record type used to hold additional notes for a domain. Commonly used for email authentication. - PTR Record: A record type used to map an IPv4 address to a FQDN, in the opposite fashion of an A Record. Used for reverse DNS lookups. ## Special characters - IDN: Internationalized Domain Name; a domain name that contains language-specific script or alphabet elements such as Arabic, Chinese, Cyrillic, Hebrew, etc. E.g. bbc.在线 - Punycode: The ASCII representation of an IDN, used as a conversion layer for domain names that contain language-specific scripts or alphabet elements. E.g. bbc.xn--3ds443g - Homoglyphs: A text character that looks similar to another. In DNS, it's typically seen as part of an IDN. E.g. a (Latin) looks like the completely different characters а (Cyrillic) and α (Greek).